sqgame.net
October 1, 2024
•[ supply chain attack, malware, backdoor ]
ScarCruft/INKY SQUID compromised Windows and Android components of the sqgame.net gaming platform serving ethnic Koreans in China's Yanbian region, trojanizing game files and update components with RokRAT and BirdCall backdoors. ESET estimated the compromise began in late 2024, with Android malware development beginning around October 2024 and Windows update components malicious since at least November 2024.
Pitney Bowes
April 8, 2026
•[ phishing, extortion, data leak ]
Pitney Bowes identified unauthorized access to certain records in its Salesforce customer relationship management environment on April 9, 2026, after a phishing attack compromised an employee email account the previous night. ShinyHunters claimed to have obtained Pitney Bowes data as part of a broader extortion campaign and later released data containing 8.2 million unique email addresses, names, phone numbers, physical addresses, and some employee job-title records. Irish reporting separately confirmed that 137 Revenue Commissioners employees were affected through the Pitney Bowes supplier breach, with professional contact details exposed but no Revenue passwords or taxpayer data stolen.
At least one DAEMON Tools user in government, scientific, manufacturing, retail, or education sectors
April 8, 2026
•[ supply chain attack, malware, trojanized installers ]
Threat actors compromised official DAEMON Tools installers distributed from the vendor website beginning April 8, 2026. The trojanized installers executed malware on infected Windows hosts, collected system information, and in selected cases deployed additional backdoor payloads. Reporting identified second-stage payloads on roughly a dozen machines in government, scientific, manufacturing, and retail organizations in Russia, Belarus, and Thailand, and QUIC RAT on one Russian educational institution. The specific perpetrator was not publicly identified.
At least one node-ipc npm package users
May 14, 2026
•[ supply chain attack, malicious package, credential theft ]
Attackers abused a dormant node-ipc npm maintainer account, likely after re-registering an expired maintainer email domain, and published malicious node-ipc versions 9.1.6, 9.2.3, and 12.0.1 on May 14, 2026. The packages contained an obfuscated credential-stealing payload that harvested developer and CI/CD secrets and exfiltrated them through DNS TXT queries.
RubyGems.org
May 12, 2026
•[ malicious packages, supply chain attack, bot accounts ]
RubyGems.org temporarily suspended new account registrations after threat actors used bot accounts to push more than 500 junk or malicious packages, including packages carrying exploits. Existing packages were not compromised, and gem installs and pushes for existing users were unaffected while maintainers tightened account-creation rate limiting and WAF protections.
Kelp DAO
April 19, 2026
•[ DDoS, RPC poisoning, Cryptocurrency theft ]
NGB 3rd Technical Surveillance Bureau (TraderTraitor) compromised and poisoned LayerZero RPC infrastructure, launched a DDoS to force failover to the poisoned nodes, and delivered a malicious instruction that drained 116,500 rsETH, worth roughly $292 million, from Kelp DAO.
Anodot
April 4, 2026
•[ data breach, token theft, unauthorized access ]
ShinyHunters allegedly breached Anodot, causing its data connectors to stop working and enabling downstream customer cloud-data access through stolen tokens.
CPUID (cpuid.com)
April 9, 2026
•[ malware distribution, supply chain attack, api compromise ]
CPUID confirmed that a secondary website/API feature was compromised between April 9 and April 10, 2026, causing official download links for CPU-Z, HWMonitor, HWMonitor Pro, and PerfMonitor to redirect to attacker-controlled infrastructure serving malware; CPUID said its signed original files were not modified.
Roan and Eurocamp
March 16, 2026
•[ data breach, phishing, supply chain attack ]
Roan and Eurocamp disclosed that an unauthorized third party exploited a vulnerability in a third-party technology provider on March 16, 2026 and stole guest booking data later used in WhatsApp scam attempts; no encryption was reported.
LiteLLM
March 24, 2026
•[ supply chain attack, malware, credential theft ]
TeamPCP used compromised release access to publish malicious LiteLLM versions to PyPI, embedding code that exfiltrated secrets and established persistence on systems that installed the poisoned packages.
Checkmarx
March 23, 2026
•[ supply chain attack, malware distribution, compromised artifacts ]
TeamPCP used compromised Checkmarx distribution channels to publish malicious versions of developer tooling, exposing users who downloaded the affected artifacts during the publication window.
Trivy
March 19, 2026
•[ supply chain attack, malicious code, credential-stealing malware ]
TeamPCP compromised Trivy-related release components and published malicious code that turned trusted Trivy software artifacts into delivery vehicles for credential-stealing malware.
Axios Javascript Client Library
March 31, 2026
•[ supply chain attack, account takeover, malware ]
A threat actor hijacked the npm account of Axios's lead maintainer and published malicious versions 1.14.1 and 0.30.4 with a hidden dependency that deployed a RAT on systems that installed the packages; the poisoned versions were later removed.
Duet Night Abyss
March 18, 2026
•[ malware, infostealer, supply chain attack ]
Kotaku reported that on March 18, 2026 Duet Night Abyss players PCs were infected after a malicious update was pushed through the games launcher. The malware was identified by users antivirus products as 'Trojan:MSIL/UmbralStealer.DG!MTB' (Umbral Stealer), an infostealer capable of logging keystrokes, taking screenshots, and attempting to harvest sensitive information such as passwords and cryptocurrency-related data. The developers said they addressed the issue and apologized, describing it as an external malicious attack spread via the launcher update.
Undisclosed contractor supporting National Bank of Ukraine numismatic online store
February 19, 2026
•[ data leak, supply chain attack, cyberattack ]
Attackers breached an undisclosed contractor supporting the National Bank of Ukraine's numismatic online store, potentially exposing customer registration and delivery data; the online store was temporarily taken offline while the incident was investigated.
Mutua Madrileña
September 27, 2024
•[ cyber attack, data leak, third-party breach ]
Mutua Madrilea suffers a cyber attack on its home customer base, through an external provider, which affects thousands of customers.
Korrespondent.net
June 27, 2017
•[ NotPetya, ransomware, malware ]
Threat actors deploy a tool, called NotPetya, with the purpose of encrypting data on victims' machines and rendering it unusable. The malware was spread through tax software that companies and individuals require for filing taxes in Ukraine and spread globally.'Australia, Estonia,'Denmark, Lithuania, Ukraine, the United Kingdom, and the United States issued statements attributing NotPetya to Russian state-sponsored actors.
Trust wallet
December 24, 2025
•[ supply chain attack, cryptocurrency theft, malicious browser extension ]
Trust Wallet said a December 24, 2025 incident led to roughly $8.5M stolen from more than 2,500 crypto wallets after attackers published a malicious version of its Chrome extension (v2.68.0) containing a JavaScript payload that collected sensitive wallet data and enabled unauthorized transactions. Trust Wallet stated that developer GitHub secrets were exposed, giving the attacker access to extension source code and a Chrome Web Store API key; with that key, the attacker could upload builds directly, bypassing Trust Wallets internal approval/manual review process. Trust Wallet said it revoked release APIs, coordinated registrar action to suspend attacker domains used to host malicious code, began reimbursing affected users, and warned about impersonation scams targeting victims.
eScan Antivirus (MicroWorld Technologies)
January 20, 2026
•[ supply chain attack, malware delivery, software update ]
Attackers breached an eScan update server and replaced a legitimate update file with a malicious executable, resulting in malware delivery to customers via the software supply chain without confirmed data theft or operational disruption.
Pornhub
August 11, 2025
•[ extortion, phishing, data leak ]
Cybercriminal group ShinyHunters claimed theft of a 94GB dataset containing about 201 million records tied to Pornhub Premium user activity and launched an extortion campaign demanding payment in Bitcoin. Reporting linked the compromise to third-party analytics provider Mixpanel, where access allegedly began on November 8, 2025 after a smishing attack harvested employee login credentials. Samples reviewed by journalists reportedly included email addresses, approximate location (city/country), video titles and URLs, search keywords, and timestamps for watches/downloads. Pornhub stated its internal systems were not directly hacked and that sensitive items such as passwords and credit card details remained secure, while Mixpanel later suggested some access may have involved a legitimate employee account associated with Pornhubs parent company, Aylo.
